Skip to content

Commit d7a69f0

Browse files
ttakahashi21ttakahashi21
committed
Add blog post for cross namespace data sources alpha
1 parent 8fee63a commit d7a69f0

File tree

1 file changed

+159
-0
lines changed

1 file changed

+159
-0
lines changed

‎content/en/blog/_posts/2023-01-02-cross-namespace-data-sources-alpha.md

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
---
2+
layout: blog
3+
title: "Kubernetes v1.26: Alpha support for cross-namespace storage data sources"
4+
date: 2023-01-02
5+
slug: cross-namespace-data-sources-alpha
6+
---
7+
8+
**Author:** Takafumi Takahashi (Hitachi Vantara)
9+
10+
Kubernetes v1.26, released last month, introduced an alpha feature that
11+
lets you specify a data source for a PersistentVolumeClaim, even where the source
12+
data belong to a different namespace.
13+
With the new feature enabled, you specify a namespace in the `dataSourceRef` field of
14+
a new PersistentVolumeClaim. Once Kubernetes checks that access is OK, the new
15+
PersistentVolume can populate its data from the storage source specified in that other
16+
namespace.
17+
Before Kubernetes v1.26, provided your cluster had the `AnyVolumeDataSource` feature enabled,
18+
you could already provision new volumes from a data source in the **same**
19+
namespace.
20+
However, that only worked for the data source in the same namespace,
21+
therefore users couldn't provision a PersistentVolume with a claim
22+
in one namespace from a data source in other namespace.
23+
To solve this problem, Kubernetes v1.26 added a new alpha `namespace` field
24+
to `dataSourceRef` field in PersistentVolumeClaim the API.
25+
26+
## How it works
27+
28+
Once the csi-provisioner finds that a data source is specified with a `dataSourceRef` that
29+
has a non-empty namespace name,
30+
it checks all reference grants within the namespace that's specified by the`.spec.dataSourceRef.namespace`
31+
field of the PersistentVolumeClaim, in order to see if access to the data source is allowed.
32+
If any ReferenceGrant allows access, the csi-provisioner provisions a volume from the data source.
33+
34+
## Trying it out
35+
36+
The following things are required to use cross namespace volume provisioning:
37+
38+
* Enable the `AnyVolumeDataSource` and `CrossNamespaceVolumeDataSource` [feature gates](/docs/reference/command-line-tools-reference/feature-gates/) for the kube-apiserver and kube-controller-manager
39+
* Install a CRD for the specific `VolumeSnapShot` controller
40+
* Install the CSI Provisioner controller and enable the `CrossNamespaceVolumeDataSource` feature gate
41+
* Install the CSI driver
42+
* Install a CRD for ReferenceGrants
43+
44+
## Putting it all together
45+
46+
To see how this works, you can install the sample and try it out.
47+
This sample do to create PVC in dev namespace from VolumeSnapshot in prod namespace.
48+
That is a simple example. For real world use, you might want to use a more complex approach.
49+
50+
### Assumptions for this example {#example-assumptions}
51+
52+
* Your Kubernetes cluster was deployed with `AnyVolumeDataSource` and `CrossNamespaceVolumeDataSource` feature gates enabled
53+
* There are two namespaces, dev and prod
54+
* CSI driver is being deployed
55+
* There is an existing VolumeSnapshot named `new-snapshot-demo` in the _prod_ namespace
56+
* The ReferenceGrant CRD (from the Gateway API project) is already deployed
57+
58+
### Grant ReferenceGrants read permission to the CSI Provisioner
59+
60+
Access to ReferenceGrants is only needed when the CSI driver
61+
has the `CrossNamespaceVolumeDataSource` controller capability.
62+
For this example, the external-provisioner needs **get**, **list**, and **watch**
63+
permissions for `referencegrants` (API group `gateway.networking.k8s.io`).
64+
65+
```yaml
66+
- apiGroups: ["gateway.networking.k8s.io"]
67+
resources: ["referencegrants"]
68+
verbs: ["get", "list", "watch"]
69+
```
70+
71+
### Enable the CrossNamespaceVolumeDataSource feature gate for the CSI Provisioner
72+
73+
Add `--feature-gates=CrossNamespaceVolumeDataSource=true` to the csi-provisioner command line.
74+
For example, use this manifest snippet to redefine the container:
75+
76+
```yaml
77+
- args:
78+
- -v=5
79+
- --csi-address=/csi/csi.sock
80+
- --feature-gates=Topology=true
81+
- --feature-gates=CrossNamespaceVolumeDataSource=true
82+
image: csi-provisioner:latest
83+
imagePullPolicy: IfNotPresent
84+
name: csi-provisioner
85+
```
86+
87+
### Create a ReferenceGrant
88+
89+
Here's a manifest for an example ReferenceGrant.
90+
91+
```yaml
92+
apiVersion: gateway.networking.k8s.io/v1beta1
93+
kind: ReferenceGrant
94+
metadata:
95+
name: allow-prod-pvc
96+
namespace: prod
97+
spec:
98+
from:
99+
- group: ""
100+
kind: PersistentVolumeClaim
101+
namespace: dev
102+
to:
103+
- group: snapshot.storage.k8s.io
104+
kind: VolumeSnapshot
105+
name: new-snapshot-demo
106+
```
107+
108+
### Create a PersistentVolumeClaim by using cross namespace data source
109+
110+
Kubernetes creates a PersistentVolumeClaim on dev and the CSI driver populates
111+
the PersistentVolume used on dev from snapshots on prod.
112+
113+
```yaml
114+
apiVersion: v1
115+
kind: PersistentVolumeClaim
116+
metadata:
117+
name: example-pvc
118+
namespace: dev
119+
spec:
120+
storageClassName: example
121+
accessModes:
122+
- ReadWriteOnce
123+
resources:
124+
requests:
125+
storage: 1Gi
126+
dataSourceRef:
127+
apiGroup: snapshot.storage.k8s.io
128+
kind: VolumeSnapshot
129+
name: new-snapshot-demo
130+
namespace: prod
131+
volumeMode: Filesystem
132+
```
133+
134+
## How can I learn more?
135+
136+
The enhancement proposal,
137+
[Provision volumes from cross-namespace snapshots](https://github.com/kubernetes/enhancements/tree/master/keps/sig-storage/3294-provision-volumes-from-cross-namespace-snapshots), includes lots of detail about the history and technical implementation of this feature.
138+
139+
Please get involved by joining the [Kubernetes Storage Special Interest Group (SIG)](https://github.com/kubernetes/community/tree/master/sig-storage)
140+
to help us enhance this feature.
141+
There are a lot of good ideas already and we'd be thrilled to have more!
142+
143+
## Acknowledgments
144+
145+
It takes a wonderful group to make wonderful software.
146+
Special thanks to the following people for the insightful reviews,
147+
thorough consideration and valuable contribution to the CrossNamespaceVolumeDataSouce feature:
148+
149+
* Michelle Au (msau42)
150+
* Xing Yang (xing-yang)
151+
* Masaki Kimura (mkimuram)
152+
* Tim Hockin (thockin)
153+
* Ben Swartzlander (bswartz)
154+
* Rob Scott (robscott)
155+
* John Griffith (j-griffith)
156+
* Michael Henriksen (mhenriks)
157+
* Mustafa Elbehery (Elbehery)
158+
159+
It’s been a joy to work with y'all on this.

0 commit comments

Comments
 (0)